| @@ -10,8 +10,9 @@ | ||
| 10 | 10 | use WP_Defender\Component; |
| 11 | 11 | use WP_Defender\Model\Scan; |
| 12 | 12 | use WP_Defender\Model\Scan_Item; |
| 13 | 13 | use WP_Defender\Controller\Scan as Scan_Controller; |
| 14 | +use WP_Filesystem_Base; | |
| 14 | 15 | |
| 15 | 16 | /** |
| 16 | 17 | * Responsible for handling legacy data migration and management related to scan issues and ignored items. |
| 17 | 18 | * |
| @@ -48,20 +49,38 @@ | ||
| 48 | 49 | */ |
| 49 | 50 | private function find_all_scan_ignored_items( $ids ) { |
| 50 | 51 | global $wpdb; |
| 51 | 52 | |
| 52 | - if ( is_array( $ids ) && count( $ids ) > 0 ) { | |
| 53 | - $sql = 'SELECT t0.ID AS id,t0.post_parent AS parentId,t1.meta_value AS type,t2.meta_value AS raw'; | |
| 54 | - $sql .= ' FROM ' . $wpdb->posts . ' AS t0'; | |
| 55 | - $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t1 ON t1.post_id=ID AND t1.meta_key='type'"; | |
| 56 | - $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t2 ON t2.post_id=ID AND t2.meta_key='raw'"; | |
| 57 | - $sql .= " WHERE t0.post_type='wdf_scan_item' AND t0.post_status = 'ignored'"; | |
| 58 | - $sql .= ' AND t0.ID IN (' . implode( ', ', $ids ) . ')'; | |
| 59 | - // SQL is prepared above. so we will ignore prepare warning. | |
| 60 | - return $wpdb->get_results( $sql, ARRAY_A ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery | |
| 53 | + if ( ! is_array( $ids ) ) { | |
| 54 | + return array(); | |
| 61 | 55 | } |
| 62 | 56 | |
| 63 | - return array(); | |
| 57 | + $valid_ids = array(); | |
| 58 | + foreach ( $ids as $id ) { | |
| 59 | + if ( ! is_int( $id ) && ! ( is_string( $id ) && ctype_digit( $id ) ) ) { | |
| 60 | + continue; | |
| 61 | + } | |
| 62 | + | |
| 63 | + $id = filter_var( $id, FILTER_VALIDATE_INT ); | |
| 64 | + if ( false !== $id && 0 < $id ) { | |
| 65 | + $valid_ids[ $id ] = $id; | |
| 66 | + } | |
| 67 | + } | |
| 68 | + $ids = array_values( $valid_ids ); | |
| 69 | + if ( array() === $ids ) { | |
| 70 | + return array(); | |
| 71 | + } | |
| 72 | + | |
| 73 | + $placeholders = implode( ', ', array_fill( 0, count( $ids ), '%d' ) ); | |
| 74 | + $sql = 'SELECT t0.ID AS id,t0.post_parent AS parentId,t1.meta_value AS type,t2.meta_value AS raw'; | |
| 75 | + $sql .= ' FROM ' . $wpdb->posts . ' AS t0'; | |
| 76 | + $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t1 ON t1.post_id=ID AND t1.meta_key='type'"; | |
| 77 | + $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t2 ON t2.post_id=ID AND t2.meta_key='raw'"; | |
| 78 | + $sql .= " WHERE t0.post_type='wdf_scan_item' AND t0.post_status = 'ignored'"; | |
| 79 | + $sql .= " AND t0.ID IN ({$placeholders})"; | |
| 80 | + | |
| 81 | + // SQL is prepared above. so we will ignore prepare warning. | |
| 82 | + return $wpdb->get_results( $wpdb->prepare( $sql, $ids ), ARRAY_A ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery | |
| 64 | 83 | } |
| 65 | 84 | |
| 66 | 85 | /** |
| 67 | 86 | * Adapts old scan data format to the new format. |
| @@ -74,9 +93,9 @@ | ||
| 74 | 93 | $raw = ''; |
| 75 | 94 | switch ( $old_data['type'] ) { |
| 76 | 95 | case 'vuln': |
| 77 | 96 | $new_type = Scan_Item::TYPE_VULNERABILITY; |
| 78 | - if ( isset( $old_data['raw'] ) && ! empty( $old_data['raw'] ) ) { | |
| 97 | + if ( isset( $old_data['raw'] ) && '' !== $old_data['raw'] ) { | |
| 79 | 98 | $raw = maybe_unserialize( $old_data['raw'] ); |
| 80 | 99 | /** |
| 81 | 100 | * Different $raw['slug'] values depending on the type: |
| 82 | 101 | * 'type' => 'theme', 'slug' => {THEME_SLUG}, ... |
| @@ -102,9 +121,9 @@ | ||
| 102 | 121 | } |
| 103 | 122 | break; |
| 104 | 123 | case 'content': |
| 105 | 124 | $new_type = Scan_Item::TYPE_SUSPICIOUS; |
| 106 | - if ( isset( $old_data['raw'] ) && ! empty( $old_data['raw'] ) ) { | |
| 125 | + if ( isset( $old_data['raw'] ) && '' !== $old_data['raw'] ) { | |
| 107 | 126 | $raw = maybe_unserialize( $old_data['raw'] ); |
| 108 | 127 | $file = is_array( $raw ) && isset( $raw['file'] ) ? $raw['file'] : ''; |
| 109 | 128 | } else { |
| 110 | 129 | $file = ''; |
| @@ -115,9 +134,9 @@ | ||
| 115 | 134 | break; |
| 116 | 135 | case 'core': |
| 117 | 136 | default: |
| 118 | 137 | $new_type = Scan_Item::TYPE_INTEGRITY; |
| 119 | - if ( isset( $old_data['raw'] ) && ! empty( $old_data['raw'] ) ) { | |
| 138 | + if ( isset( $old_data['raw'] ) && '' !== $old_data['raw'] ) { | |
| 120 | 139 | $raw = maybe_unserialize( $old_data['raw'] ); |
| 121 | 140 | $file = is_array( $raw ) && isset( $raw['file'] ) ? $raw['file'] : ''; |
| 122 | 141 | } else { |
| 123 | 142 | $file = ''; |
| @@ -148,9 +167,9 @@ | ||
| 148 | 167 | * @param array $issue_items Array of issue items to save. |
| 149 | 168 | * @param Scan $model Scan model instance to use for saving. |
| 150 | 169 | */ |
| 151 | 170 | private function save_scan_issue_data( $issue_items, $model ) { |
| 152 | - if ( empty( $issue_items ) ) { | |
| 171 | + if ( ! is_array( $issue_items ) || array() === $issue_items ) { | |
| 153 | 172 | return; |
| 154 | 173 | } |
| 155 | 174 | // Get existed issues. |
| 156 | 175 | $existed_issues = $model->get_issues( null, Scan_Item::STATUS_ACTIVE ); |
| @@ -156,12 +175,12 @@ | ||
| 156 | 175 | $existed_issues = $model->get_issues( null, Scan_Item::STATUS_ACTIVE ); |
| 157 | 176 | $unique_arr = array(); |
| 158 | 177 | foreach ( $issue_items as $item ) { |
| 159 | 178 | $data = $this->adapt_scan_data( $item ); |
| 160 | - if ( empty( $data['file'] ) ) { | |
| 179 | + if ( '' === $data['file'] ) { | |
| 161 | 180 | continue; |
| 162 | 181 | } |
| 163 | - if ( ! empty( $existed_issues ) ) { | |
| 182 | + if ( is_array( $existed_issues ) && array() !== $existed_issues ) { | |
| 164 | 183 | // Scan was started in version > 2.3.2. |
| 165 | 184 | foreach ( $existed_issues as $issue ) { |
| 166 | 185 | if ( Scan_Item::TYPE_VULNERABILITY === $data['type'] ) { |
| 167 | 186 | $file_name = $issue->raw_data['base_slug'] ?? ''; |
| @@ -191,9 +210,9 @@ | ||
| 191 | 210 | * @param array $ignored_items Array of ignored items to save. |
| 192 | 211 | * @param Scan $model Scan model instance to use for saving. |
| 193 | 212 | */ |
| 194 | 213 | private function save_scan_ignored_data( $ignored_items, $model ) { |
| 195 | - if ( empty( $ignored_items ) ) { | |
| 214 | + if ( ! is_array( $ignored_items ) || array() === $ignored_items ) { | |
| 196 | 215 | return; |
| 197 | 216 | } |
| 198 | 217 | // Get INDEXER of ignored issues. |
| 199 | 218 | $index_lists = get_site_option( Scan::IGNORE_INDEXER, array() ); |
| @@ -200,12 +219,12 @@ | ||
| 200 | 219 | // Get existed ignored issues. |
| 201 | 220 | $existed_issues = $model->get_issues( null, Scan_Item::STATUS_IGNORE ); |
| 202 | 221 | foreach ( $ignored_items as $item ) { |
| 203 | 222 | $data = $this->adapt_scan_data( $item ); |
| 204 | - if ( empty( $data['file'] ) ) { | |
| 223 | + if ( '' === $data['file'] ) { | |
| 205 | 224 | continue; |
| 206 | 225 | } |
| 207 | - if ( ! empty( $existed_issues ) ) { | |
| 226 | + if ( is_array( $existed_issues ) && array() !== $existed_issues ) { | |
| 208 | 227 | // Scan was started in version > 2.3.2 . |
| 209 | 228 | foreach ( $existed_issues as $issue ) { |
| 210 | 229 | if ( Scan_Item::TYPE_VULNERABILITY === $data['type'] ) { |
| 211 | 230 | $file_name = $issue->raw_data['base_slug'] ?? ''; |
| @@ -240,9 +259,8 @@ | ||
| 240 | 259 | * |
| 241 | 260 | * @return array Array of all scan issue data. |
| 242 | 261 | */ |
| 243 | 262 | public function get_scan_issue_data() { |
| 244 | - | |
| 245 | 263 | return $this->find_all_scan_issue_items(); |
| 246 | 264 | } |
| 247 | 265 | |
| 248 | 266 | /** |
| @@ -267,9 +285,9 @@ | ||
| 267 | 285 | * |
| 268 | 286 | * @return int ID of the scan. |
| 269 | 287 | */ |
| 270 | 288 | private function run_simlpe_scan() { |
| 271 | - $scan_component = wd_di()->get( Scan::class ); | |
| 289 | + $scan_component = wd_di()->get( \WP_Defender\Component\Scan::class ); | |
| 272 | 290 | $scan_model = wd_di()->get( Scan::class ); |
| 273 | 291 | // The simplest data. |
| 274 | 292 | $scan_model->percent = 100; |
| 275 | 293 | $scan_model->total_tasks = 1; |
| @@ -326,9 +344,9 @@ | ||
| 326 | 344 | * @param array $ignored_list List of ignored items to remove. |
| 327 | 345 | */ |
| 328 | 346 | public function remove_old_scan_data( $issue_list, $ignored_list ) { |
| 329 | 347 | // Delete the list of scan issues. |
| 330 | - if ( ! empty( $issue_list ) ) { | |
| 348 | + if ( is_array( $issue_list ) && array() !== $issue_list ) { | |
| 331 | 349 | $parent_post_id = (int) $issue_list[0]['parentId']; |
| 332 | 350 | foreach ( $issue_list as $key => $issue ) { |
| 333 | 351 | // Delete scan items. |
| 334 | 352 | wp_delete_post( (int) $issue['id'] ); |
| @@ -336,9 +354,9 @@ | ||
| 336 | 354 | // Delete scan. |
| 337 | 355 | wp_delete_post( $parent_post_id ); |
| 338 | 356 | } |
| 339 | 357 | // Delete the ignored list. |
| 340 | - if ( ! empty( $ignored_list ) ) { | |
| 358 | + if ( is_array( $ignored_list ) && array() !== $ignored_list ) { | |
| 341 | 359 | $parent_post_id = (int) $ignored_list[0]['parentId']; |
| 342 | 360 | foreach ( $ignored_list as $key => $item ) { |
| 343 | 361 | // Delete scan items. |
| 344 | 362 | wp_delete_post( (int) $item['id'] ); |
| @@ -367,9 +385,9 @@ | ||
| 367 | 385 | * @return bool|string Decrypted data or false on failure. |
| 368 | 386 | */ |
| 369 | 387 | private static function decrypt_data_with_pub_key( $encrypt_data, $key ) { |
| 370 | 388 | // This is not obfuscation. Just decode a base64-encoded string. |
| 371 | - $str = base64_decode( $encrypt_data ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode | |
| 389 | + $str = base64_decode( $encrypt_data, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode | |
| 372 | 390 | if ( ! $str ) { |
| 373 | 391 | return false; |
| 374 | 392 | } |
| 375 | 393 | $cipher = 'aes-256-cbc'; |
| @@ -389,9 +407,9 @@ | ||
| 389 | 407 | */ |
| 390 | 408 | public static function get_decrypted_data_with_pub_key( $data ) { |
| 391 | 409 | global $wp_filesystem; |
| 392 | 410 | // Initialize the WP filesystem, no more using 'file-put-contents' function. |
| 393 | - if ( empty( $wp_filesystem ) ) { | |
| 411 | + if ( ! $wp_filesystem instanceof WP_Filesystem_Base ) { | |
| 394 | 412 | require_once ABSPATH . '/wp-admin/includes/file.php'; |
| 395 | 413 | WP_Filesystem(); |
| 396 | 414 | } |
| 397 | 415 | $path_to_pub_key = __DIR__ . '/def.key'; |
